---
id: 5239
title: "The Phantom Deposit: How Unvested Rewards and Empty Vaults Lead to Yield Theft in ERC4626"
source_domain: hackenproof.com
source_url: "https://hackenproof.com/blog/erc4626-phantom-deposit-unvested-rewards-exploit"
published_at: "2026-06-22 11:52"
tags: ["bug-bounty", "web3", "vulnerability-research", "smart-contracts", "defi", "erc4626", "vault-accounting", "yield-theft"]
phying_url: "https://phying.com/item/5239"
lang: en
---

# The Phantom Deposit: How Unvested Rewards and Empty Vaults Lead to Yield Theft in ERC4626

## Summary

A guest deep-dive into ERC4626 vault accounting: how unvested rewards combined with a zero-supply state — the 'phantom deposit' — can be gamed to steal yield, from a confidential bounty find.

## Intelligence Metadata

- **Sources:** hackenproof.com
- **Published:** 2026-06-22 11:52
- **Original:** https://hackenproof.com/blog/erc4626-phantom-deposit-unvested-rewards-exploit
- **Phying News:** https://phying.com/item/5239